NRF Access Token Flow for Secure AI Model Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing network repository function (NRF) in the service-based architecture (SBA) is inadequate for securing AI/ML model authorization and sharing, necessitating additional steps to ensure security and flexibility in model access.
Innovation Solution
A communication method involving a network repository function network element that receives authorization requests, determines model producer elements, and issues access tokens based on vendor and interoperability identifiers to ensure secure model authorization and sharing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the existing network repository function (NRF) in the service-based architecture (SBA) is used for model authorization, then the authorization process can be simplified, but the security of model authorization and sharing cannot be ensured
Solution Approach 1:
The patent introduces a network repository function network element as an intermediary between the first network function (model consumer) and the model producer network element. This intermediary receives authorization requests, determines the appropriate model producer based on vendor and interoperability identifiers, coordinates the authorization process, and issues access tokens. This mediator approach enables a structured multi-step authorization flow that enhances security while maintaining operational ease through automated identifier-based resolution.
2Reliability
If additional authorization steps are implemented to ensure model security, then the security of model authorization is improved, but the complexity of the authorization process increases
Solution Approach 1:
The patent implements preliminary action by requiring the network repository function network element to determine the model producer network element based on vendor identifiers and interoperability identifiers before the actual authorization occurs. This pre-determination step organizes the authorization flow in advance, identifies the correct producer beforehand, and prepares the authorization context, thereby reducing the complexity of the subsequent authorization steps while maintaining high security through a structured multi-step process.
3Adaptability or versatility
If the network repository function determines model producer elements based on vendor and interoperability identifiers, then the flexibility and accuracy of model authorization is improved, but the complexity of identifier matching increases
Solution Approach 1:
The patent applies self-service by enabling the network repository function network element to automatically determine the model producer network element using vendor identifiers and interoperability identifiers contained in the authorization request. The system autonomously performs the identifier matching and producer identification without requiring manual intervention or complex external coordination, thereby achieving high adaptability and flexibility while managing complexity through automated self-determination logic.
Data Source
AI summary
This application provides a communication method including: A network repository function network element receives, from a first network function, a first request message requesting to authorize the first network function to obtain a model. The network repository function network element sends, to a model producer network element based on the first request message, a second request message requesting to determine whether to authorize the first network function to obtain the model. The network repository network element generates a first access token based on the second response message, where the second response message indicates that the first network function is authorized to obtain the model, and the first access token indicates that the first network function is authorized to obtain the model. The network repository function network element sends a first response message including the first access token to the first network function.